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J> | Abstract 
l> 

In a quantum computer any superposition of inputs evolves unitarily into the correspond- 
^{■^ • ing superposition of outputs. It has been recently demonstrated that such computers can 

dramatically speed up the task of finding factors of large numbers - a problem of great 
l/^ ■ practical significance because of its cryptographic applications. Instead of the nearly ex- 

ponential (~ expL 1 / 3 , for a number with L digits) time required by the fastest classical 
algorithm, the quantum algorithm gives factors in a time polynomial in L (~ L 2 ). This 
CIh! enormous speed-up is possible in principle because quantum computation can simultane- 

ously follow all of the paths corresponding to the distinct classical inputs, obtaining the 
solution as a result of coherent quantum interference between the alternatives. Hence, a 
quantum computer is sophisticated interference device, and it is essential for its quantum 
state to remain coherent in the course of the operation. In this report we investigate the 
effect of decoherence on the quantum factorization algorithm and establish an upper bound 
on a "quantum factorizable" L based on the decoherence suffered per operational step. 

X 

The uniqueness of the prime factorization of a positive integer is the Fundamental Theorem 
of Arithmetic Q. However, in practice, the determination of the prime factors of a given number 
can be an exceedingly difficult problem, although verification is trivial. This asymmetry is the 
basis for modern cryptography, and provides secret codes used not only on your own bank card 
but also to transfer diplomatic messages between embassies. 

Attempts to undermine the security provided by the difficulty of factorization have met with 
failure by and large, even with the aid of powerful modern computers. In fact, this problem 
is widely believed to have no polynomial-time algorithm ||], although a proof of this statement 
has remained elusive. The best known classical computer algorithm^] to factor a number N of 
L digits takes a time exponential in L 1 / 3 . 

In contrast, one of usQ has shown recently that with the help of a quantum computer one 
can factor numbers in a random polynomial amount of time. Therefore these new computers 
could be a threat to what is presently the most common method of encrypted message transfer. 
However, it is still unknown whether such machines are practical, because they depend crucially 
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on quantum-mechanical behavior which is uncommon to our mostly classical world. This issue 
is one of decoherence||, the subject of our study. 

The quantum factoring algorithm uses in an essential way the coherence of a quantum 
wavefunction. In a nutshell, to factor a number N one chooses a number x at random and 
calculates its order r modulo N, i.e. finds r such that x r = 1 mod N. Once r is known, factors 
of N may often be found using the Chinese remainder theorem. The difficulty is to calculate 
r. The quantum factoring algorithm goes as follows. First choose a smooth number (one with 
small prime factors) q such that N 2 < q < 2N 2 and build the state; 

1 «=J 

\^) = — J2w,o), a) 

from which can be obtained (using a quantum computer) 

1 9-1 

=-= El a > x<1 mod JV> . (2) 

V Q a=0 

We can now Fourier transform this pure state (again using a quantum computer) to get; 

q-l q-l 

|V> 3 } = -J2Yl ei27TaC/q I c > xa m °d N), (3) 

1 c =0 a=0 

and measure both arguments of this superposition, obtaining c for the first one and some x k 
as the answer for the second one (k being any number between and r). Given the pure state 
|^3), probabilities of different results for this measurement will be given by the probability 
distribution; 

' 1 



P(c, x k ) 
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where the prime indicates a restricted sum over values of a which satisfy x a = x k mod N. This 
function has periodicity q/r, but as we know q, we can determine r with a few trial executions 
(an example is shown in Fig. [l]). A measurement thus gives with high probability c = Xq/r, 
where A is an integer which corresponds to a particular peak in Fig. [I]. With a few runs of the 
program, we can deduce r and thus the factors of N. 

The algorithm discussed above assumes that the quantum computer was completely isolated. 
In practice this will certainly not be the case. It is the effect of imperfect isolation which we 
study here. A first obvious effect is that the quantum computer will lose energy. This happens 
at the rate T re i, the relaxation time-scale. It is relatively easy to make systems for which r re i 
can be very large and thus allow a reasonable number of operation to complete. A much more 
insidious effect of imperfect isolation is decoherence[5]. Decoherence is caused by the continuous 
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interaction between the system (in our case the quantum computer) and the environment [5-7]. 
As a result, the state of the environment "monitors," and therefore becomes correlated with, 
the state of the system. As a quantum system evolves, information about its states leaks out 
into the environment, causing them to loose their purity, and, consequently, their ability to 
interfere. 

It is important to realize that the timescale for decoherence r^ ec is much smaller than the 
one for relaxation. For example, an oscillator of mass m in a superposition of coherent states 
(separated by a distance Ax from each other) interacting linearly with a bath at temperature 
T has the decoherence time[pj 

2 

(5) 

where XdB is the thermal de Broglie wavelength. This expression is valid for high temperatures 
only; at low temperatures, the t^c becomes inversely proportional to the cut-off frequency of 
the bath. It is crucial to realize that no net energy transfer is needed to effect decoherence. 
This implies a much greater sensitivity of quantum computation to decoherence than to the 
relaxation process. 

The decoherence process has been proposed as a mechanism for enforcing classical behavior 
in the macroscopic realm. Decoherence results in environment-induced superselection^j, [6|. 
fij which destroys superpositions between the states of preferred pointer basis ||. Classical 
computers are already decohered - computation takes them through a predictable sequence of 
such pointer states, which are stable in spite of the environment. Thus, classical computers 
cannot be put in arbitrary superpositions and cannot take advantage of the quantum factoring 
algorithm. But coupling with the environment will also be inevitable for any system employed to 
implement the quantum factoring algorithm. Here, we will show what the effect of decoherence 
on the quantum factoring algorithm is. 

Our model involves the introduction of the environment as a system external to the com- 
puter. Its state is represented by third label. The input state may thus be written as 

1 *=J 

|^i) = — $>,0)x|e>, (6) 

V q a=0 

where e are the degrees of freedom of the environment. The environment is initially uncorrelated 
with the computer; however, it is likely that the interaction between bits necessary for the 
calculation of x a mod N will involve some interaction with the environment, so that the next 
state, 

1 «-i 

\>h) = £>, * a mod N) x |e a ) , (7) 
yi a=0 

leaves the environment partially correlated with the state of the computer. Now, if the physical 
representation for the computer's quantum bits is diagonal in the pointer basis of the environ- 
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ment, then decoherence results in no adverse effects when measuring the second label of \ip2)- 
Such a design would be optimal. We thus focus on the effects of decoherence on the first label, 
by suppressing the second label, and tracing over the environment to obtain the reduced density 
matrix; 

1 q l i 9-1 

Pred = ~ X' X' I 1 ~ @ aa ' l a M a 'l- ( 8 ) 

^ a=0 a'=0 

Here 1 — [3 aa i = |(e a |e a /)| 2 is a measure of the accuracy with which the state of the environment 
has become correlated with the state of the quantum computer. If |o) and \a!) are quantum bit 
register states diagonal in the pointer basis, then we may take; 

1 - Paa> ~ exp [-£(a tg) a')] , (9) 

where x is defined as the exclusive-or (XOR) function, and gives the Hamming distance^ 
between a and a' . £ is a constant parameter which depends on the particular realization of the 
quantum computer. The measurement results in a probability distribution, shown in Fig. [2|, 
which differs from the one in eq. (4) (see Fig. 1) in that non-zero-probabilities have appeared 
between the peaks and that these peaks have decreased in amplitude. 

The qualitative effect of decoherence is well approximated by the simpler function 1 — (3 aa > = 
<W + (1 — $aa')f3, where (3 is a constant. For (3 = we get the state with complete coherence 
and (3 = 1 one with complete decoherence (i.e., a matrix diagonal in the pointer state). In 
the limit of (3 ~ 1, we may understand (3 using the fractional amount of information lost 
to the environment, expressed as Sf/S max = 1 — (1 — f3) 2 , where S max is the entropy of a 
completely decohered computer and Sf is the difference between the entropy of the final state 
of the computer and the one from the initial state (assumed to be nearly zero). For (3 ~ 0.5 the 
probability between the peaks (see Fig. ^) is equal to the one of the peaks, and thus there is as 
much chance to get a correct answer than a wrong one. Once (1 - (3)- 1 ~ 0(exp[(log iV) 1/3 ]), 
the quantum computer becomes as inefficient as a classical one. In this case it would take a 
number of trials exponential in (log iV) 1 / 3 in order to factor the number N. 

In principle it is easy to calculate (3 from an experiment. If we allow the input to be in the 
superposition | fj n ) + | |j n ) then the coefficient (3 is given by 

3 = 1- -11 LlL (in) 

hi + Pa 

In a two slit experiment, it is the ratio between the amplitude of the destructive and constructive 
interference on the screen also called the fringe visibility function. 

It is reasonable to assume, to first approximation, that the loss of coherence is linear with 
the number of operations in the computation. This is equivalent to saying that the environment 
keeps no memory of the system as it evolves from one step to another. Thus 1 — f3 ~ n op a, 



4 



where a is the coherence lost in a simple operation (once coherence is lost in such systems it 
cannot be regained). When a is small it can also be interpreted as the fractional information 
loss per operation, i.e. such that AS/S max = a. n op is the operation count, n op ~ [logiV] 2 . It 
is therefore possible to estimate the total loss of quantum coherence by studying only one part 
of the computer. To factor a number N the quantum algorithm uses 0([ln N] 2 ) operations and 
therefore a -1 ~ 0([ln N] 2 ). The quantum computer allows a significant amount of decoherence. 
One of the reasons is that factoring is in the class of the so-called NP functions, i.e. functions 
which are hard to solve but once the answer is known it is fairly easy to verify. The quantum 
computer can therefore run until we find the correct factors. 

How much entropy is lost to the environment per step? Designs for quantum computers 
have been suggested^, [HJ |TT], 12] and some possible difficulties investigated [13, 14 1. Common 
to these designs is the model of a simple two state system interacting with an ensemble of 
oscillators (the environment), from which we can get an idea for what a is. We use as a 
Hamiltonian 



A 



H = —a x + ixa z C n q n + ^h n . 



(11) 



where the cr's are Pauli matrices, q n are the coordinates of the environment oscillators and h n 
are harmonic oscillator Hamiltonians (a cutoff A is implicit). It can be seen that without the 
environment, a state of the system of the form | j) turns into the state (| T) + I l))/v2 in a 
time 7r/2A. This a typical step for a quantum computer. 

Thus, the effect of a zero temperature environment is to decrease the off-diagonal term of 



the density matrix by the amount [15] 



a ~ 
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Here, C is Euler's constant and r\ is the viscosity coefficient determined by the spectral density 
of the oscillators. A non-zero temperature will further increase the value of a. 

With perfect operation, each execution trial gives a factor of N with probability O (log N) , 
but with decoherence, the number of trials required becomes 0(log N/(l — 0)). In terms of a, 
we find that with decoherence, the required number of executions of the quantum algorithm to 
find a factor of is of order 



Number of trials 



L 



1-L 2 



a 
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where L = logN. To give performance better than the classical algorithm, we must therefore 
have that 



L 



< exp 



L V3 



(14) 



1 - L 2 a 

Using eq (12) and (14) we find that the largest number which can be factored efficiently 
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with a quantum computer is 
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~ exp 
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The quantum algorithm to factor numbers uses the quantum computer as a huge interferometer. 
When it is perfectly isolated, the interference fringes give the important clue to the factors. 
When isolation is not perfect anymore there are chances that the result is irrelevant for factoring. 
The quantum computer is efficient as long as we can discover the interference pattern in a 
number of trials less than the one given by the classical algorithm. 

Many are skeptical of the possibility of building useful quantum computers. This attitude is 
largely fuelled by the inevitability of decoherence and the fragility of the information encoded in 
coherent quantum superposition [1 



14]. In particular, error correction which ensures reliability 
of classical computers may be very difficult to accomplish quantum mechanically. We note that 
these critical remarks, while well taken, are based on a classical paradigm: Computers are 
useful when they always (or almost always) get right answers. By contrast, as a result of 
decoherence quantum computers will often give wrong answers. However, providing that the 
resulting probability distribution still gives one a clue of what the right answers are, quantum 
computers will be useful. This is because for one-way functions (which form a substantial class 
of NP-hard problems) verification is trivial. Thus a probability distribution emerging form a 
quantum computer may suffice: Fringes in an interference experiment allow one to identify the 
characteristic frequency of a source even when the contrast is far from perfect. 
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Figure 1: Probability distribution for the measurement of c in the state given in Eq.(||) with 
2V = 21, q = 128, x = 5, k = 3. The broadening of the peaks is a result of using discrete 
Fourier transform with q possible modes; a continuous Fourier transform would have given 
delta functions. 



Figure 2: Effect of decoherence on the probability distribution for the measurement of c. The 
state given by Eq.(Q) once a if Fourier transformed. The decoherence parameter Eq.(^) has 
been taken to be £ = 0.1. The dotted line shows the good agreement of our constant-beta 
approximation, taking (3 = 0.58. 
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This figure "figl-l.png" is available in "png" format from: 



http://arXiv.org/ps/quant-ph/9503007vl 



FFTd shor state, N=21 , x=5, q=1 28 



- r 






■ ■ ■ 



















































































































































J 




V 






J 


{ 


J 


V 





20 



40 



60 

State index 



80 



100 



120 



Figure 1 



This figure "figl-2.png" is available in "png" format from: 



http://arXiv.org/ps/quant-ph/9503007vl 
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